trunk: add core xselinux support.
This commit is contained in:
Chris PeBenito
parent
e828954c63
commit
2c12b471ad
@ -1,3 +1,4 @@
|
|||||||
|
- Add core Security Enhanced X Windows support.
|
||||||
- Fix winbind socket connection interface for default location of the
|
- Fix winbind socket connection interface for default location of the
|
||||||
sock_file.
|
sock_file.
|
||||||
- Add wireshark module based on ethereal module.
|
- Add wireshark module based on ethereal module.
|
||||||
|
|||||||
2
Makefile
2
Makefile
@ -236,7 +236,7 @@ seusers := $(appconf)/seusers
|
|||||||
appdir := $(contextpath)
|
appdir := $(contextpath)
|
||||||
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
|
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
|
||||||
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
|
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
|
||||||
appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
|
appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
|
||||||
net_contexts := $(builddir)net_contexts
|
net_contexts := $(builddir)net_contexts
|
||||||
|
|
||||||
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
|
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
|
||||||
|
|||||||
194
config/appconfig-mcs/x_contexts
Normal file
194
config/appconfig-mcs/x_contexts
Normal file
@ -0,0 +1,194 @@
|
|||||||
|
#
|
||||||
|
# Config file for XSELinux extension
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Clients
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# The default client rule defines a context to be used for all clients
|
||||||
|
# connecting to the server from a remote host.
|
||||||
|
#
|
||||||
|
client * system_u:object_r:remote_xclient_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Properties
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Property rules map a property name to a context. A default property
|
||||||
|
# rule indicated by an asterisk should follow all other property rules.
|
||||||
|
#
|
||||||
|
# Properties that normal clients may only read
|
||||||
|
property XFree86_VT system_u:object_r:info_xproperty_t:s0
|
||||||
|
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
|
||||||
|
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
|
||||||
|
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
|
||||||
|
property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
|
||||||
|
|
||||||
|
# Clipboard and selection properties
|
||||||
|
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
property * system_u:object_r:xproperty_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Extensions
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Extension rules map an extension name to a context. A default extension
|
||||||
|
# rule indicated by an asterisk should follow all other extension rules.
|
||||||
|
#
|
||||||
|
# Standard extensions
|
||||||
|
extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
|
||||||
|
extension SHAPE system_u:object_r:std_xext_t:s0
|
||||||
|
extension SYNC system_u:object_r:std_xext_t:s0
|
||||||
|
extension XC-MISC system_u:object_r:std_xext_t:s0
|
||||||
|
extension XFIXES system_u:object_r:std_xext_t:s0
|
||||||
|
extension XInputExtension system_u:object_r:std_xext_t:s0
|
||||||
|
extension XKEYBOARD system_u:object_r:std_xext_t:s0
|
||||||
|
extension DAMAGE system_u:object_r:std_xext_t:s0
|
||||||
|
extension RENDER system_u:object_r:std_xext_t:s0
|
||||||
|
extension XINERAMA system_u:object_r:std_xext_t:s0
|
||||||
|
|
||||||
|
# Direct hardware access extensions
|
||||||
|
extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
|
||||||
|
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
|
||||||
|
|
||||||
|
# Screen management and multihead extensions
|
||||||
|
extension RANDR system_u:object_r:output_xext_t:s0
|
||||||
|
extension Composite system_u:object_r:output_xext_t:s0
|
||||||
|
|
||||||
|
# Screensaver, power management extensions
|
||||||
|
extension DPMS system_u:object_r:screensaver_xext_t:s0
|
||||||
|
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
|
||||||
|
|
||||||
|
# Shared memory extensions
|
||||||
|
extension MIT-SHM system_u:object_r:shmem_xext_t:s0
|
||||||
|
extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
|
||||||
|
|
||||||
|
# Accelerated graphics, OpenGL, direct rendering extensions
|
||||||
|
extension GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
|
||||||
|
# Debugging, testing, and recording extensions
|
||||||
|
extension RECORD system_u:object_r:debug_xext_t:s0
|
||||||
|
extension X-Resource system_u:object_r:debug_xext_t:s0
|
||||||
|
extension XTEST system_u:object_r:debug_xext_t:s0
|
||||||
|
|
||||||
|
# Security-related extensions
|
||||||
|
extension SECURITY system_u:object_r:security_xext_t:s0
|
||||||
|
extension SELinux system_u:object_r:security_xext_t:s0
|
||||||
|
extension XAccessControlExtension system_u:object_r:security_xext_t:s0
|
||||||
|
extension XC-APPGROUP system_u:object_r:security_xext_t:s0
|
||||||
|
|
||||||
|
# Video extensions
|
||||||
|
extension XVideo system_u:object_r:video_xext_t:s0
|
||||||
|
extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
extension * system_u:object_r:xext_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Selections
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
# Selection rules map a selection name to a context. A default selection
|
||||||
|
# rule indicated by an asterisk should follow all other selection rules.
|
||||||
|
#
|
||||||
|
# Standard selections
|
||||||
|
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
selection * system_u:object_r:xselection_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Events
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Event rules map an event protocol name to a context. A default event
|
||||||
|
# rule indicated by an asterisk should follow all other event rules.
|
||||||
|
#
|
||||||
|
# Input events
|
||||||
|
event X11:KeyPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:KeyRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:ButtonPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:MotionNotify system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
|
||||||
|
|
||||||
|
# Focus events
|
||||||
|
event X11:FocusIn system_u:object_r:focus_xevent_t:s0
|
||||||
|
event X11:FocusOut system_u:object_r:focus_xevent_t:s0
|
||||||
|
event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
|
||||||
|
event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
|
||||||
|
|
||||||
|
# Property events
|
||||||
|
event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
|
||||||
|
|
||||||
|
# Client message events
|
||||||
|
event X11:ClientMessage system_u:object_r:client_xevent_t:s0
|
||||||
|
|
||||||
|
# Manager events
|
||||||
|
event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:MapRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:MapNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:Expose system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
|
||||||
|
# Unknown events (that are not registered in the X server's name database)
|
||||||
|
event <unknown> system_u:object_r:unknown_xevent_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
event * system_u:object_r:xevent_t:s0
|
||||||
194
config/appconfig-mls/x_contexts
Normal file
194
config/appconfig-mls/x_contexts
Normal file
@ -0,0 +1,194 @@
|
|||||||
|
#
|
||||||
|
# Config file for XSELinux extension
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Clients
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# The default client rule defines a context to be used for all clients
|
||||||
|
# connecting to the server from a remote host.
|
||||||
|
#
|
||||||
|
client * system_u:object_r:remote_xclient_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Properties
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Property rules map a property name to a context. A default property
|
||||||
|
# rule indicated by an asterisk should follow all other property rules.
|
||||||
|
#
|
||||||
|
# Properties that normal clients may only read
|
||||||
|
property XFree86_VT system_u:object_r:info_xproperty_t:s0
|
||||||
|
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
|
||||||
|
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
|
||||||
|
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
|
||||||
|
property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
|
||||||
|
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
|
||||||
|
|
||||||
|
# Clipboard and selection properties
|
||||||
|
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
property * system_u:object_r:xproperty_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Extensions
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Extension rules map an extension name to a context. A default extension
|
||||||
|
# rule indicated by an asterisk should follow all other extension rules.
|
||||||
|
#
|
||||||
|
# Standard extensions
|
||||||
|
extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
|
||||||
|
extension SHAPE system_u:object_r:std_xext_t:s0
|
||||||
|
extension SYNC system_u:object_r:std_xext_t:s0
|
||||||
|
extension XC-MISC system_u:object_r:std_xext_t:s0
|
||||||
|
extension XFIXES system_u:object_r:std_xext_t:s0
|
||||||
|
extension XInputExtension system_u:object_r:std_xext_t:s0
|
||||||
|
extension XKEYBOARD system_u:object_r:std_xext_t:s0
|
||||||
|
extension DAMAGE system_u:object_r:std_xext_t:s0
|
||||||
|
extension RENDER system_u:object_r:std_xext_t:s0
|
||||||
|
extension XINERAMA system_u:object_r:std_xext_t:s0
|
||||||
|
|
||||||
|
# Direct hardware access extensions
|
||||||
|
extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
|
||||||
|
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
|
||||||
|
|
||||||
|
# Screen management and multihead extensions
|
||||||
|
extension RANDR system_u:object_r:output_xext_t:s0
|
||||||
|
extension Composite system_u:object_r:output_xext_t:s0
|
||||||
|
|
||||||
|
# Screensaver, power management extensions
|
||||||
|
extension DPMS system_u:object_r:screensaver_xext_t:s0
|
||||||
|
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
|
||||||
|
|
||||||
|
# Shared memory extensions
|
||||||
|
extension MIT-SHM system_u:object_r:shmem_xext_t:s0
|
||||||
|
extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
|
||||||
|
|
||||||
|
# Accelerated graphics, OpenGL, direct rendering extensions
|
||||||
|
extension GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||||
|
|
||||||
|
# Debugging, testing, and recording extensions
|
||||||
|
extension RECORD system_u:object_r:debug_xext_t:s0
|
||||||
|
extension X-Resource system_u:object_r:debug_xext_t:s0
|
||||||
|
extension XTEST system_u:object_r:debug_xext_t:s0
|
||||||
|
|
||||||
|
# Security-related extensions
|
||||||
|
extension SECURITY system_u:object_r:security_xext_t:s0
|
||||||
|
extension SELinux system_u:object_r:security_xext_t:s0
|
||||||
|
extension XAccessControlExtension system_u:object_r:security_xext_t:s0
|
||||||
|
extension XC-APPGROUP system_u:object_r:security_xext_t:s0
|
||||||
|
|
||||||
|
# Video extensions
|
||||||
|
extension XVideo system_u:object_r:video_xext_t:s0
|
||||||
|
extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
extension * system_u:object_r:xext_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Selections
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
# Selection rules map a selection name to a context. A default selection
|
||||||
|
# rule indicated by an asterisk should follow all other selection rules.
|
||||||
|
#
|
||||||
|
# Standard selections
|
||||||
|
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
selection * system_u:object_r:xselection_t:s0
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Events
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Event rules map an event protocol name to a context. A default event
|
||||||
|
# rule indicated by an asterisk should follow all other event rules.
|
||||||
|
#
|
||||||
|
# Input events
|
||||||
|
event X11:KeyPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:KeyRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:ButtonPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:MotionNotify system_u:object_r:input_xevent_t:s0
|
||||||
|
event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
|
||||||
|
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
|
||||||
|
|
||||||
|
# Focus events
|
||||||
|
event X11:FocusIn system_u:object_r:focus_xevent_t:s0
|
||||||
|
event X11:FocusOut system_u:object_r:focus_xevent_t:s0
|
||||||
|
event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
|
||||||
|
event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
|
||||||
|
|
||||||
|
# Property events
|
||||||
|
event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
|
||||||
|
|
||||||
|
# Client message events
|
||||||
|
event X11:ClientMessage system_u:object_r:client_xevent_t:s0
|
||||||
|
|
||||||
|
# Manager events
|
||||||
|
event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:MapRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:MapNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:Expose system_u:object_r:manage_xevent_t:s0
|
||||||
|
event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
|
||||||
|
|
||||||
|
# Unknown events (that are not registered in the X server's name database)
|
||||||
|
event <unknown> system_u:object_r:unknown_xevent_t:s0
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
event * system_u:object_r:xevent_t:s0
|
||||||
194
config/appconfig-standard/x_contexts
Normal file
194
config/appconfig-standard/x_contexts
Normal file
@ -0,0 +1,194 @@
|
|||||||
|
#
|
||||||
|
# Config file for XSELinux extension
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Clients
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# The default client rule defines a context to be used for all clients
|
||||||
|
# connecting to the server from a remote host.
|
||||||
|
#
|
||||||
|
client * system_u:object_r:remote_xclient_t
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Properties
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Property rules map a property name to a context. A default property
|
||||||
|
# rule indicated by an asterisk should follow all other property rules.
|
||||||
|
#
|
||||||
|
# Properties that normal clients may only read
|
||||||
|
property XFree86_VT system_u:object_r:info_xproperty_t
|
||||||
|
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t
|
||||||
|
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t
|
||||||
|
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t
|
||||||
|
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t
|
||||||
|
property AT_SPI_IOR system_u:object_r:info_xproperty_t
|
||||||
|
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t
|
||||||
|
property _NET_WORKAREA system_u:object_r:info_xproperty_t
|
||||||
|
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t
|
||||||
|
|
||||||
|
# Clipboard and selection properties
|
||||||
|
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t
|
||||||
|
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
property * system_u:object_r:xproperty_t
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Extensions
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Extension rules map an extension name to a context. A default extension
|
||||||
|
# rule indicated by an asterisk should follow all other extension rules.
|
||||||
|
#
|
||||||
|
# Standard extensions
|
||||||
|
extension BIG-REQUESTS system_u:object_r:std_xext_t
|
||||||
|
extension SHAPE system_u:object_r:std_xext_t
|
||||||
|
extension SYNC system_u:object_r:std_xext_t
|
||||||
|
extension XC-MISC system_u:object_r:std_xext_t
|
||||||
|
extension XFIXES system_u:object_r:std_xext_t
|
||||||
|
extension XInputExtension system_u:object_r:std_xext_t
|
||||||
|
extension XKEYBOARD system_u:object_r:std_xext_t
|
||||||
|
extension DAMAGE system_u:object_r:std_xext_t
|
||||||
|
extension RENDER system_u:object_r:std_xext_t
|
||||||
|
extension XINERAMA system_u:object_r:std_xext_t
|
||||||
|
|
||||||
|
# Direct hardware access extensions
|
||||||
|
extension XFree86-DGA system_u:object_r:directhw_xext_t
|
||||||
|
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t
|
||||||
|
|
||||||
|
# Screen management and multihead extensions
|
||||||
|
extension RANDR system_u:object_r:output_xext_t
|
||||||
|
extension Composite system_u:object_r:output_xext_t
|
||||||
|
|
||||||
|
# Screensaver, power management extensions
|
||||||
|
extension DPMS system_u:object_r:screensaver_xext_t
|
||||||
|
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t
|
||||||
|
|
||||||
|
# Shared memory extensions
|
||||||
|
extension MIT-SHM system_u:object_r:shmem_xext_t
|
||||||
|
extension XFree86-Bigfont system_u:object_r:shmem_xext_t
|
||||||
|
|
||||||
|
# Accelerated graphics, OpenGL, direct rendering extensions
|
||||||
|
extension GLX system_u:object_r:accelgraphics_xext_t
|
||||||
|
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t
|
||||||
|
extension NV-GLX system_u:object_r:accelgraphics_xext_t
|
||||||
|
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t
|
||||||
|
|
||||||
|
# Debugging, testing, and recording extensions
|
||||||
|
extension RECORD system_u:object_r:debug_xext_t
|
||||||
|
extension X-Resource system_u:object_r:debug_xext_t
|
||||||
|
extension XTEST system_u:object_r:debug_xext_t
|
||||||
|
|
||||||
|
# Security-related extensions
|
||||||
|
extension SECURITY system_u:object_r:security_xext_t
|
||||||
|
extension SELinux system_u:object_r:security_xext_t
|
||||||
|
extension XAccessControlExtension system_u:object_r:security_xext_t
|
||||||
|
extension XC-APPGROUP system_u:object_r:security_xext_t
|
||||||
|
|
||||||
|
# Video extensions
|
||||||
|
extension XVideo system_u:object_r:video_xext_t
|
||||||
|
extension XVideo-MotionCompensation system_u:object_r:video_xext_t
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
extension * system_u:object_r:xext_t
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Selections
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
# Selection rules map a selection name to a context. A default selection
|
||||||
|
# rule indicated by an asterisk should follow all other selection rules.
|
||||||
|
#
|
||||||
|
# Standard selections
|
||||||
|
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t
|
||||||
|
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t
|
||||||
|
selection PRIMARY system_u:object_r:clipboard_xselection_t
|
||||||
|
selection CLIPBOARD system_u:object_r:clipboard_xselection_t
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
selection * system_u:object_r:xselection_t
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
##
|
||||||
|
### Rules for X Events
|
||||||
|
##
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# Event rules map an event protocol name to a context. A default event
|
||||||
|
# rule indicated by an asterisk should follow all other event rules.
|
||||||
|
#
|
||||||
|
# Input events
|
||||||
|
event X11:KeyPress system_u:object_r:input_xevent_t
|
||||||
|
event X11:KeyRelease system_u:object_r:input_xevent_t
|
||||||
|
event X11:ButtonPress system_u:object_r:input_xevent_t
|
||||||
|
event X11:ButtonRelease system_u:object_r:input_xevent_t
|
||||||
|
event X11:MotionNotify system_u:object_r:input_xevent_t
|
||||||
|
event X11:SelectionNotify system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t
|
||||||
|
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t
|
||||||
|
|
||||||
|
# Focus events
|
||||||
|
event X11:FocusIn system_u:object_r:focus_xevent_t
|
||||||
|
event X11:FocusOut system_u:object_r:focus_xevent_t
|
||||||
|
event X11:EnterNotify system_u:object_r:focus_xevent_t
|
||||||
|
event X11:LeaveNotify system_u:object_r:focus_xevent_t
|
||||||
|
|
||||||
|
# Property events
|
||||||
|
event X11:PropertyNotify system_u:object_r:property_xevent_t
|
||||||
|
|
||||||
|
# Client message events
|
||||||
|
event X11:ClientMessage system_u:object_r:client_xevent_t
|
||||||
|
|
||||||
|
# Manager events
|
||||||
|
event X11:ConfigureRequest system_u:object_r:manage_xevent_t
|
||||||
|
event X11:ResizeRequest system_u:object_r:manage_xevent_t
|
||||||
|
event X11:MapRequest system_u:object_r:manage_xevent_t
|
||||||
|
event X11:CirculateRequest system_u:object_r:manage_xevent_t
|
||||||
|
event X11:CreateNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:DestroyNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:MapNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:UnmapNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:ReparentNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:ConfigureNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:GravityNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:CirculateNotify system_u:object_r:manage_xevent_t
|
||||||
|
event X11:Expose system_u:object_r:manage_xevent_t
|
||||||
|
event X11:VisibilityNotify system_u:object_r:manage_xevent_t
|
||||||
|
|
||||||
|
# Unknown events (that are not registered in the X server's name database)
|
||||||
|
event <unknown> system_u:object_r:unknown_xevent_t
|
||||||
|
|
||||||
|
# Default fallback type
|
||||||
|
event * system_u:object_r:xevent_t
|
||||||
@ -416,141 +416,160 @@ class passwd
|
|||||||
#
|
#
|
||||||
# SE-X Windows stuff
|
# SE-X Windows stuff
|
||||||
#
|
#
|
||||||
class drawable
|
class x_drawable
|
||||||
{
|
{
|
||||||
create
|
create
|
||||||
destroy
|
destroy
|
||||||
draw
|
read
|
||||||
copy
|
write
|
||||||
getattr
|
blend
|
||||||
}
|
|
||||||
|
|
||||||
class gc
|
|
||||||
{
|
|
||||||
create
|
|
||||||
free
|
|
||||||
getattr
|
getattr
|
||||||
setattr
|
setattr
|
||||||
|
list_child
|
||||||
|
add_child
|
||||||
|
remove_child
|
||||||
|
list_property
|
||||||
|
get_property
|
||||||
|
set_property
|
||||||
|
manage
|
||||||
|
override
|
||||||
|
show
|
||||||
|
hide
|
||||||
|
send
|
||||||
|
receive
|
||||||
}
|
}
|
||||||
|
|
||||||
class window
|
class x_screen
|
||||||
|
{
|
||||||
|
getattr
|
||||||
|
setattr
|
||||||
|
hide_cursor
|
||||||
|
show_cursor
|
||||||
|
saver_getattr
|
||||||
|
saver_setattr
|
||||||
|
saver_hide
|
||||||
|
saver_show
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_gc
|
||||||
{
|
{
|
||||||
addchild
|
|
||||||
create
|
create
|
||||||
destroy
|
destroy
|
||||||
map
|
|
||||||
unmap
|
|
||||||
chstack
|
|
||||||
chproplist
|
|
||||||
chprop
|
|
||||||
listprop
|
|
||||||
getattr
|
getattr
|
||||||
setattr
|
setattr
|
||||||
setfocus
|
|
||||||
move
|
|
||||||
chselection
|
|
||||||
chparent
|
|
||||||
ctrllife
|
|
||||||
enumerate
|
|
||||||
transparent
|
|
||||||
mousemotion
|
|
||||||
clientcomevent
|
|
||||||
inputevent
|
|
||||||
drawevent
|
|
||||||
windowchangeevent
|
|
||||||
windowchangerequest
|
|
||||||
serverchangeevent
|
|
||||||
extensionevent
|
|
||||||
}
|
|
||||||
|
|
||||||
class font
|
|
||||||
{
|
|
||||||
load
|
|
||||||
free
|
|
||||||
getattr
|
|
||||||
use
|
use
|
||||||
}
|
}
|
||||||
|
|
||||||
class colormap
|
class x_font
|
||||||
{
|
{
|
||||||
create
|
create
|
||||||
free
|
destroy
|
||||||
install
|
|
||||||
uninstall
|
|
||||||
list
|
|
||||||
read
|
|
||||||
store
|
|
||||||
getattr
|
getattr
|
||||||
setattr
|
add_glyph
|
||||||
|
remove_glyph
|
||||||
|
use
|
||||||
}
|
}
|
||||||
|
|
||||||
class property
|
class x_colormap
|
||||||
{
|
{
|
||||||
create
|
create
|
||||||
free
|
destroy
|
||||||
read
|
read
|
||||||
write
|
write
|
||||||
|
getattr
|
||||||
|
add_color
|
||||||
|
remove_color
|
||||||
|
install
|
||||||
|
uninstall
|
||||||
|
use
|
||||||
}
|
}
|
||||||
|
|
||||||
class cursor
|
class x_property
|
||||||
{
|
{
|
||||||
create
|
create
|
||||||
createglyph
|
destroy
|
||||||
free
|
read
|
||||||
assign
|
write
|
||||||
setattr
|
append
|
||||||
}
|
|
||||||
|
|
||||||
class xclient
|
|
||||||
{
|
|
||||||
kill
|
|
||||||
}
|
|
||||||
|
|
||||||
class xinput
|
|
||||||
{
|
|
||||||
lookup
|
|
||||||
getattr
|
getattr
|
||||||
setattr
|
setattr
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_selection
|
||||||
|
{
|
||||||
|
read
|
||||||
|
write
|
||||||
|
getattr
|
||||||
|
setattr
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_cursor
|
||||||
|
{
|
||||||
|
create
|
||||||
|
destroy
|
||||||
|
read
|
||||||
|
write
|
||||||
|
getattr
|
||||||
|
setattr
|
||||||
|
use
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_client
|
||||||
|
{
|
||||||
|
destroy
|
||||||
|
getattr
|
||||||
|
setattr
|
||||||
|
manage
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_device
|
||||||
|
{
|
||||||
|
getattr
|
||||||
|
setattr
|
||||||
|
use
|
||||||
|
read
|
||||||
|
write
|
||||||
|
getfocus
|
||||||
setfocus
|
setfocus
|
||||||
warppointer
|
|
||||||
activegrab
|
|
||||||
passivegrab
|
|
||||||
ungrab
|
|
||||||
bell
|
bell
|
||||||
mousemotion
|
force_cursor
|
||||||
relabelinput
|
freeze
|
||||||
}
|
|
||||||
|
|
||||||
class xserver
|
|
||||||
{
|
|
||||||
screensaver
|
|
||||||
gethostlist
|
|
||||||
sethostlist
|
|
||||||
getfontpath
|
|
||||||
setfontpath
|
|
||||||
getattr
|
|
||||||
grab
|
grab
|
||||||
ungrab
|
manage
|
||||||
}
|
}
|
||||||
|
|
||||||
class xextension
|
class x_server
|
||||||
|
{
|
||||||
|
getattr
|
||||||
|
setattr
|
||||||
|
record
|
||||||
|
debug
|
||||||
|
grab
|
||||||
|
manage
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_extension
|
||||||
{
|
{
|
||||||
query
|
query
|
||||||
use
|
use
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
class x_resource
|
||||||
# Define the access vector interpretation for controlling
|
|
||||||
# PaX flags
|
|
||||||
#
|
|
||||||
class pax
|
|
||||||
{
|
{
|
||||||
pageexec # Paging based non-executable pages
|
read
|
||||||
emutramp # Emulate trampolines
|
write
|
||||||
mprotect # Restrict mprotect()
|
}
|
||||||
randmmap # Randomize mmap() base
|
|
||||||
randexec # Randomize ET_EXEC base
|
class x_event
|
||||||
segmexec # Segmentation based non-executable pages
|
{
|
||||||
|
send
|
||||||
|
receive
|
||||||
|
}
|
||||||
|
|
||||||
|
class x_synthetic_event
|
||||||
|
{
|
||||||
|
send
|
||||||
|
receive
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
#
|
||||||
|
|||||||
@ -50,21 +50,19 @@ class ipc
|
|||||||
# passwd/chfn/chsh
|
# passwd/chfn/chsh
|
||||||
class passwd # userspace
|
class passwd # userspace
|
||||||
|
|
||||||
# SE-X Windows stuff
|
# SE-X Windows stuff (more classes below)
|
||||||
class drawable # userspace
|
class x_drawable # userspace
|
||||||
class window # userspace
|
class x_screen # userspace
|
||||||
class gc # userspace
|
class x_gc # userspace
|
||||||
class font # userspace
|
class x_font # userspace
|
||||||
class colormap # userspace
|
class x_colormap # userspace
|
||||||
class property # userspace
|
class x_property # userspace
|
||||||
class cursor # userspace
|
class x_selection # userspace
|
||||||
class xclient # userspace
|
class x_cursor # userspace
|
||||||
class xinput # userspace
|
class x_client # userspace
|
||||||
class xserver # userspace
|
class x_device # userspace
|
||||||
class xextension # userspace
|
class x_server # userspace
|
||||||
|
class x_extension # userspace
|
||||||
# pax flags; deprecated--can be reclaimed
|
|
||||||
class pax # userspace
|
|
||||||
|
|
||||||
# extended netlink sockets
|
# extended netlink sockets
|
||||||
class netlink_route_socket
|
class netlink_route_socket
|
||||||
@ -112,4 +110,9 @@ class peer
|
|||||||
# Capabilities >= 32
|
# Capabilities >= 32
|
||||||
class capability2
|
class capability2
|
||||||
|
|
||||||
|
# More SE-X Windows stuff
|
||||||
|
class x_resource # userspace
|
||||||
|
class x_event # userspace
|
||||||
|
class x_synthetic_event # userspace
|
||||||
|
|
||||||
# FLASK
|
# FLASK
|
||||||
|
|||||||
199
policy/mls
199
policy/mls
@ -371,78 +371,53 @@ mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec se
|
|||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the drawable class
|
# MLS policy for the x_drawable class
|
||||||
#
|
#
|
||||||
|
|
||||||
# the drawable "read" ops (implicit single level)
|
# the x_drawable "read" ops (implicit single level)
|
||||||
mlsconstrain drawable { getattr copy }
|
mlsconstrain x_drawable { read blend getattr list_child list_property get_property receive }
|
||||||
(( l1 dom l2 ) or
|
(( l1 dom l2 ) or
|
||||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
( t1 == mlsxwinread ));
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
# the drawable "write" ops (implicit single level)
|
# the x_drawable "write" ops (implicit single level)
|
||||||
mlsconstrain drawable { create destroy draw copy }
|
mlsconstrain x_drawable { create destroy write setattr add_child remove_child send manage }
|
||||||
|
(( l1 eq l2 ) or
|
||||||
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
# No MLS restrictions: x_drawable { show hide override }
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# MLS policy for the x_gc class
|
||||||
|
#
|
||||||
|
|
||||||
|
# the x_gc "read" ops (implicit single level)
|
||||||
|
mlsconstrain x_gc { getattr use }
|
||||||
|
(( l1 dom l2 ) or
|
||||||
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
|
# the x_gc "write" ops (implicit single level)
|
||||||
|
mlsconstrain x_gc { create destroy setattr }
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the gc class
|
# MLS policy for the x_font class
|
||||||
#
|
#
|
||||||
|
|
||||||
# the gc "read" ops (implicit single level)
|
# the x_font "read" ops (implicit single level)
|
||||||
mlsconstrain gc getattr
|
mlsconstrain x_font { use }
|
||||||
(( l1 dom l2 ) or
|
(( l1 dom l2 ) or
|
||||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
( t1 == mlsxwinread ));
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
# the gc "write" ops (implicit single level)
|
# the x_font "write" ops (implicit single level)
|
||||||
mlsconstrain gc { create free setattr }
|
mlsconstrain x_font { create destroy add_glyph remove_glyph }
|
||||||
(( l1 eq l2 ) or
|
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
|
||||||
( t1 == mlsxwinwrite ));
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
|
||||||
# MLS policy for the window class
|
|
||||||
#
|
|
||||||
|
|
||||||
# the window "read" ops (implicit single level)
|
|
||||||
mlsconstrain window { listprop getattr enumerate mousemotion inputevent drawevent windowchangeevent windowchangerequest serverchangeevent extensionevent }
|
|
||||||
(( l1 dom l2 ) or
|
|
||||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
|
||||||
( t1 == mlsxwinread ));
|
|
||||||
|
|
||||||
# the window "write" ops (implicit single level)
|
|
||||||
mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent }
|
|
||||||
(( l1 eq l2 ) or
|
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
|
||||||
( t1 == mlsxwinwrite ) or
|
|
||||||
( t2 == mlstrustedobject ));
|
|
||||||
|
|
||||||
# these access vectors have no MLS restrictions
|
|
||||||
# window { map unmap }
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
|
||||||
# MLS policy for the font class
|
|
||||||
#
|
|
||||||
|
|
||||||
# the font "read" ops (implicit single level)
|
|
||||||
mlsconstrain font { load getattr }
|
|
||||||
(( l1 dom l2 ) or
|
|
||||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
|
||||||
( t1 == mlsxwinread ));
|
|
||||||
|
|
||||||
# the font "write" ops (implicit single level)
|
|
||||||
mlsconstrain font free
|
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
@ -451,109 +426,147 @@ mlsconstrain font free
|
|||||||
# font use
|
# font use
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the colormap class
|
# MLS policy for the x_colormap class
|
||||||
#
|
#
|
||||||
|
|
||||||
# the colormap "read" ops (implicit single level)
|
# the x_colormap "read" ops (implicit single level)
|
||||||
mlsconstrain colormap { list read getattr }
|
mlsconstrain x_colormap { read getattr use }
|
||||||
(( l1 dom l2 ) or
|
(( l1 dom l2 ) or
|
||||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
( t1 == mlsxwinreadcolormap ) or
|
( t1 == mlsxwinreadcolormap ) or
|
||||||
( t1 == mlsxwinread ));
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
# the colormap "write" ops (implicit single level)
|
# the x_colormap "write" ops (implicit single level)
|
||||||
mlsconstrain colormap { create free install uninstall store setattr }
|
mlsconstrain x_colormap { create destroy write add_color remove_color install uninstall }
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwritecolormap ) or
|
( t1 == mlsxwinwritecolormap ) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the property class
|
# MLS policy for the x_property class
|
||||||
#
|
#
|
||||||
|
|
||||||
# the property "read" ops (implicit single level)
|
# the x_property "read" ops (implicit single level)
|
||||||
mlsconstrain property { read }
|
mlsconstrain x_property { read getattr }
|
||||||
(( l1 dom l2 ) or
|
(( l1 dom l2 ) or
|
||||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
( t1 == mlsxwinreadproperty ) or
|
( t1 == mlsxwinreadproperty ) or
|
||||||
( t1 == mlsxwinread ));
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
# the property "write" ops (implicit single level)
|
# the x_property "write" ops (implicit single level)
|
||||||
mlsconstrain property { create free write }
|
mlsconstrain x_property { create destroy write append setattr }
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwriteproperty ) or
|
( t1 == mlsxwinwriteproperty ) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the cursor class
|
# MLS policy for the x_cursor class
|
||||||
#
|
#
|
||||||
|
|
||||||
# the cursor "write" ops (implicit single level)
|
# the x_cursor "read" ops (implicit single level)
|
||||||
mlsconstrain cursor { create createglyph free assign setattr }
|
mlsconstrain x_cursor { read getattr use }
|
||||||
|
(( l1 dom l2 ) or
|
||||||
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
|
# the x_cursor "write" ops (implicit single level)
|
||||||
|
mlsconstrain x_cursor { create destroy write setattr }
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the xclient class
|
# MLS policy for the x_client class
|
||||||
#
|
#
|
||||||
|
|
||||||
# the xclient "write" ops (implicit single level)
|
# the x_client "read" ops (implicit single level)
|
||||||
mlsconstrain xclient kill
|
mlsconstrain x_client { getattr }
|
||||||
|
(( l1 dom l2 ) or
|
||||||
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
|
# the x_client "write" ops (implicit single level)
|
||||||
|
mlsconstrain x_client { destroy setattr manage }
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the xinput class
|
# MLS policy for the x_device class
|
||||||
#
|
#
|
||||||
|
|
||||||
# these access vectors have no MLS restrictions
|
# the x_device "read" ops (implicit single level)
|
||||||
# xinput ~{ relabelinput setattr }
|
mlsconstrain x_device { getattr use read getfocus grab }
|
||||||
|
(( l1 dom l2 ) or
|
||||||
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
# the xinput "write" ops (implicit single level)
|
# the x_device "write" ops (implicit single level)
|
||||||
mlsconstrain xinput { setattr relabelinput }
|
mlsconstrain x_device { setattr write setfocus bell force_cursor freeze manage }
|
||||||
(( l1 eq l2 ) or
|
(( l1 eq l2 ) or
|
||||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
( t1 == mlsxwinwritexinput ) or
|
( t1 == mlsxwinwritexinput ) or
|
||||||
( t1 == mlsxwinwrite ));
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the xserver class
|
# MLS policy for the x_server class
|
||||||
#
|
#
|
||||||
|
|
||||||
# these access vectors have no MLS restrictions
|
# these access vectors have no MLS restrictions
|
||||||
# xserver *
|
# x_server *
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# MLS policy for the xextension class
|
# MLS policy for the x_extension class
|
||||||
#
|
#
|
||||||
|
|
||||||
# these access vectors have no MLS restrictions
|
# these access vectors have no MLS restrictions
|
||||||
# xextension { query use }
|
# x_extension { query use }
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# MLS policy for the x_resource class
|
||||||
|
#
|
||||||
|
|
||||||
|
# the x_resource "read" ops (implicit single level)
|
||||||
|
mlsconstrain x_resource { read }
|
||||||
|
(( l1 dom l2 ) or
|
||||||
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
|
# the x_resource "write" ops (implicit single level)
|
||||||
|
mlsconstrain x_resource { write }
|
||||||
|
(( l1 eq l2 ) or
|
||||||
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
|
( t1 == mlsxwinwritexinput ) or
|
||||||
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
#
|
||||||
|
# MLS policy for the x_event class
|
||||||
|
#
|
||||||
|
|
||||||
|
# the x_event "read" ops (implicit single level)
|
||||||
|
mlsconstrain x_event { receive }
|
||||||
|
(( l1 dom l2 ) or
|
||||||
|
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||||
|
( t1 == mlsxwinread ));
|
||||||
|
|
||||||
|
# the x_event "write" ops (implicit single level)
|
||||||
|
mlsconstrain x_event { send }
|
||||||
|
(( l1 eq l2 ) or
|
||||||
|
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||||
|
( t1 == mlsxwinwritexinput ) or
|
||||||
|
( t1 == mlsxwinwrite ));
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#
|
#
|
||||||
|
|||||||
@ -159,7 +159,7 @@ template(`ethereal_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1,$1_ethereal_t,$1_ethereal_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_ethereal,$1_ethereal_t,$1_ethereal_tmpfs_t)
|
||||||
xserver_create_xdm_tmp_sockets($1_ethereal_t)
|
xserver_create_xdm_tmp_sockets($1_ethereal_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(ethereal,1.4.0)
|
policy_module(ethereal,1.4.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -247,7 +247,7 @@ template(`evolution_per_role_template',`
|
|||||||
|
|
||||||
mta_read_config($1_evolution_t)
|
mta_read_config($1_evolution_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_evolution,$1_evolution_t,$1_evolution_tmpfs_t)
|
||||||
xserver_read_xdm_tmp_files($1_evolution_t)
|
xserver_read_xdm_tmp_files($1_evolution_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -513,7 +513,7 @@ template(`evolution_per_role_template',`
|
|||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t)
|
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_evolution_alarm,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -615,7 +615,7 @@ template(`evolution_per_role_template',`
|
|||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t)
|
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_evolution_exchange,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
|
||||||
|
|
||||||
# Access evolution home
|
# Access evolution home
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
@ -776,7 +776,7 @@ template(`evolution_per_role_template',`
|
|||||||
# until properly implemented
|
# until properly implemented
|
||||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t)
|
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_evolution_webcal,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
nscd_socket_use($1_evolution_webcal_t)
|
nscd_socket_use($1_evolution_webcal_t)
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(evolution,1.5.0)
|
policy_module(evolution,1.5.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -146,7 +146,7 @@ template(`games_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1,$1_games_t,$1_games_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_games,$1_games_t,$1_games_tmpfs_t)
|
||||||
xserver_create_xdm_tmp_sockets($1_games_t)
|
xserver_create_xdm_tmp_sockets($1_games_t)
|
||||||
xserver_read_xdm_lib_files($1_games_t)
|
xserver_read_xdm_lib_files($1_games_t)
|
||||||
')
|
')
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(games,1.5.0)
|
policy_module(games,1.5.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -130,7 +130,7 @@ template(`gift_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1,$1_gift_t,$1_gift_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_gift,$1_gift_t,$1_gift_tmpfs_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
##############################
|
##############################
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(gift,1.3.0)
|
policy_module(gift,1.3.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -164,7 +164,7 @@ template(`java_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_javaplugin,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(java,1.7.0)
|
policy_module(java,1.7.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -191,7 +191,7 @@ template(`mozilla_per_role_template',`
|
|||||||
userdom_manage_user_tmp_files($1,$1_mozilla_t)
|
userdom_manage_user_tmp_files($1,$1_mozilla_t)
|
||||||
userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
||||||
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
||||||
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
|
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(mozilla,1.5.0)
|
policy_module(mozilla,1.5.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -342,7 +342,7 @@ template(`mplayer_per_role_template',`
|
|||||||
userdom_read_user_home_content_files($1,$1_mplayer_t)
|
userdom_read_user_home_content_files($1,$1_mplayer_t)
|
||||||
userdom_read_user_home_content_symlinks($1,$1_mplayer_t)
|
userdom_read_user_home_content_symlinks($1,$1_mplayer_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_mplayer_t,$1_mplayer_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_mplayer,$1_mplayer_t,$1_mplayer_tmpfs_t)
|
||||||
|
|
||||||
# Read songs
|
# Read songs
|
||||||
ifdef(`enable_mls',`',`
|
ifdef(`enable_mls',`',`
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(mplayer,1.4.0)
|
policy_module(mplayer,1.4.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -160,7 +160,7 @@ template(`thunderbird_per_role_template',`
|
|||||||
# .kde/....gtkrc
|
# .kde/....gtkrc
|
||||||
userdom_read_user_home_content_files($1,$1_thunderbird_t)
|
userdom_read_user_home_content_files($1,$1_thunderbird_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_thunderbird,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
|
||||||
xserver_read_xdm_tmp_files($1_thunderbird_t)
|
xserver_read_xdm_tmp_files($1_thunderbird_t)
|
||||||
xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t)
|
xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t)
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(thunderbird,1.5.0)
|
policy_module(thunderbird,1.5.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -134,6 +134,6 @@ template(`tvtime_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1,$1_tvtime_t,$1_tvtime_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_tvtime,$1_tvtime_t,$1_tvtime_tmpfs_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(tvtime,1.3.0)
|
policy_module(tvtime,1.3.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -164,7 +164,7 @@ template(`vmware_per_role_template',`
|
|||||||
sysnet_dns_name_resolve($1_vmware_t)
|
sysnet_dns_name_resolve($1_vmware_t)
|
||||||
sysnet_read_config($1_vmware_t)
|
sysnet_read_config($1_vmware_t)
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_vmware_t,$1_vmware_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_vmware,$1_vmware_t,$1_vmware_tmpfs_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(vmware,1.4.0)
|
policy_module(vmware,1.4.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -609,6 +609,26 @@ interface(`mls_process_set_level',`
|
|||||||
typeattribute $1 mlsprocsetsl;
|
typeattribute $1 mlsprocsetsl;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Make specified domain MLS trusted
|
||||||
|
## for reading from X objects up to its clearance.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <rolecap/>
|
||||||
|
#
|
||||||
|
interface(`mls_xwin_read_to_clearance',`
|
||||||
|
gen_require(`
|
||||||
|
attribute mlsxwinreadtoclr;
|
||||||
|
')
|
||||||
|
|
||||||
|
typeattribute $1 mlsxwinreadtoclr;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Make specified domain MLS trusted
|
## Make specified domain MLS trusted
|
||||||
@ -629,6 +649,26 @@ interface(`mls_xwin_read_all_levels',`
|
|||||||
typeattribute $1 mlsxwinread;
|
typeattribute $1 mlsxwinread;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Make specified domain MLS trusted
|
||||||
|
## for write to X objects up to its clearance.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <rolecap/>
|
||||||
|
#
|
||||||
|
interface(`mls_xwin_write_to_clearance',`
|
||||||
|
gen_require(`
|
||||||
|
attribute mlsxwinwritetoclr;
|
||||||
|
')
|
||||||
|
|
||||||
|
typeattribute $1 mlsxwinwritetoclr;
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Make specified domain MLS trusted
|
## Make specified domain MLS trusted
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(mls,1.6.1)
|
policy_module(mls,1.6.2)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -107,7 +107,7 @@ template(`bluetooth_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
|
xserver_user_x_domain_template($1, $1_bluetooth, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(bluetooth,2.0.0)
|
policy_module(bluetooth,2.0.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -282,7 +282,7 @@ template(`ssh_per_role_template',`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xserver_user_client_template($1,$1_ssh_t,$1_ssh_tmpfs_t)
|
xserver_user_x_domain_template($1,$1_ssh,$1_ssh_t,$1_ssh_tmpfs_t)
|
||||||
xserver_domtrans_user_xauth($1,$1_ssh_t)
|
xserver_domtrans_user_xauth($1,$1_ssh_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(ssh,1.9.0)
|
policy_module(ssh,1.9.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -15,6 +15,11 @@
|
|||||||
template(`xserver_common_domain_template',`
|
template(`xserver_common_domain_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
|
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
|
||||||
|
|
||||||
|
attribute x_server_domain;
|
||||||
|
class x_drawable all_x_drawable_perms;
|
||||||
|
class x_colormap all_x_colormap_perms;
|
||||||
|
class x_screen all_x_screen_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
##############################
|
##############################
|
||||||
@ -22,7 +27,12 @@ template(`xserver_common_domain_template',`
|
|||||||
# Declarations
|
# Declarations
|
||||||
#
|
#
|
||||||
|
|
||||||
type $1_xserver_t;
|
attribute $1_x_domain;
|
||||||
|
attribute $1_input_xevent_type;
|
||||||
|
|
||||||
|
type $1_rootwindow_t, rootwindow_type;
|
||||||
|
|
||||||
|
type $1_xserver_t, x_server_domain;
|
||||||
domain_type($1_xserver_t)
|
domain_type($1_xserver_t)
|
||||||
domain_entry_file($1_xserver_t,xserver_exec_t)
|
domain_entry_file($1_xserver_t,xserver_exec_t)
|
||||||
|
|
||||||
@ -83,6 +93,9 @@ template(`xserver_common_domain_template',`
|
|||||||
manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t)
|
manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t)
|
||||||
logging_log_filetrans($1_xserver_t,xserver_log_t,file)
|
logging_log_filetrans($1_xserver_t,xserver_log_t,file)
|
||||||
|
|
||||||
|
# Labeling rules for default windows and colormaps
|
||||||
|
type_transition $1_xserver_t $1_xserver_t:{ x_drawable x_colormap } $1_rootwindow_t;
|
||||||
|
|
||||||
kernel_read_system_state($1_xserver_t)
|
kernel_read_system_state($1_xserver_t)
|
||||||
kernel_read_device_sysctls($1_xserver_t)
|
kernel_read_device_sysctls($1_xserver_t)
|
||||||
kernel_read_modprobe_sysctls($1_xserver_t)
|
kernel_read_modprobe_sysctls($1_xserver_t)
|
||||||
@ -142,6 +155,10 @@ template(`xserver_common_domain_template',`
|
|||||||
fs_search_auto_mountpoints($1_xserver_t)
|
fs_search_auto_mountpoints($1_xserver_t)
|
||||||
fs_search_ramfs($1_xserver_t)
|
fs_search_ramfs($1_xserver_t)
|
||||||
|
|
||||||
|
selinux_validate_context($1_xserver_t)
|
||||||
|
selinux_compute_access_vector($1_xserver_t)
|
||||||
|
selinux_compute_create_context($1_xserver_t)
|
||||||
|
|
||||||
auth_use_nsswitch($1_xserver_t)
|
auth_use_nsswitch($1_xserver_t)
|
||||||
|
|
||||||
init_getpgid($1_xserver_t)
|
init_getpgid($1_xserver_t)
|
||||||
@ -153,13 +170,15 @@ template(`xserver_common_domain_template',`
|
|||||||
libs_use_shared_libs($1_xserver_t)
|
libs_use_shared_libs($1_xserver_t)
|
||||||
|
|
||||||
logging_send_syslog_msg($1_xserver_t)
|
logging_send_syslog_msg($1_xserver_t)
|
||||||
|
logging_send_audit_msgs($1_xserver_t)
|
||||||
|
|
||||||
miscfiles_read_localization($1_xserver_t)
|
miscfiles_read_localization($1_xserver_t)
|
||||||
miscfiles_read_fonts($1_xserver_t)
|
miscfiles_read_fonts($1_xserver_t)
|
||||||
|
|
||||||
modutils_domtrans_insmod($1_xserver_t)
|
modutils_domtrans_insmod($1_xserver_t)
|
||||||
|
|
||||||
seutil_dontaudit_search_config($1_xserver_t)
|
# read x_contexts
|
||||||
|
seutil_read_default_contexts($1_xserver_t)
|
||||||
|
|
||||||
ifndef(`distro_redhat',`
|
ifndef(`distro_redhat',`
|
||||||
allow $1_xserver_t self:process { execmem execheap execstack };
|
allow $1_xserver_t self:process { execmem execheap execstack };
|
||||||
@ -169,6 +188,32 @@ template(`xserver_common_domain_template',`
|
|||||||
allow $1_xserver_t self:process { execmem execheap execstack };
|
allow $1_xserver_t self:process { execmem execheap execstack };
|
||||||
')
|
')
|
||||||
|
|
||||||
|
tunable_policy(`!xserver_object_manager',`
|
||||||
|
# should be xserver_unconfined($1_xserver_t),
|
||||||
|
# but typeattribute doesnt work in conditionals
|
||||||
|
gen_require(`
|
||||||
|
attribute x_server_domain, x_domain;
|
||||||
|
attribute xproperty_type, xselection_type;
|
||||||
|
attribute xextension_type, xevent_type;
|
||||||
|
attribute rootwindow_type;
|
||||||
|
|
||||||
|
type remote_xclient_t;
|
||||||
|
')
|
||||||
|
allow $1_xserver_t x_server_domain:x_server *;
|
||||||
|
allow $1_xserver_t { x_domain rootwindow_type }:x_drawable *;
|
||||||
|
allow $1_xserver_t x_server_domain:x_screen *;
|
||||||
|
allow $1_xserver_t x_domain:x_gc *;
|
||||||
|
allow $1_xserver_t { x_domain rootwindow_type }:x_colormap *;
|
||||||
|
allow $1_xserver_t xproperty_type:x_property *;
|
||||||
|
allow $1_xserver_t xselection_type:x_selection *;
|
||||||
|
allow $1_xserver_t x_domain:x_cursor *;
|
||||||
|
allow $1_xserver_t { x_domain remote_xclient_t }:x_client *;
|
||||||
|
allow $1_xserver_t { x_domain x_server_domain }:x_device *;
|
||||||
|
allow $1_xserver_t xextension_type:x_extension *;
|
||||||
|
allow $1_xserver_t { x_domain x_server_domain }:x_resource *;
|
||||||
|
allow $1_xserver_t xevent_type:{ x_event x_synthetic_event } *;
|
||||||
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
apm_stream_connect($1_xserver_t)
|
apm_stream_connect($1_xserver_t)
|
||||||
')
|
')
|
||||||
@ -415,6 +460,47 @@ template(`xserver_per_role_template',`
|
|||||||
tunable_policy(`use_samba_home_dirs',`
|
tunable_policy(`use_samba_home_dirs',`
|
||||||
fs_manage_cifs_files($1_iceauth_t)
|
fs_manage_cifs_files($1_iceauth_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
##############################
|
||||||
|
#
|
||||||
|
# User X object manager local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
# Device rules
|
||||||
|
allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell };
|
||||||
|
|
||||||
|
allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
|
||||||
|
allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send;
|
||||||
|
|
||||||
|
# manage: xhost X11:ChangeHosts
|
||||||
|
# freeze: metacity X11:GrabKey
|
||||||
|
# force_cursor: metacity X11:GrabPointer
|
||||||
|
allow $2 $1_xserver_t:x_device { manage freeze force_cursor };
|
||||||
|
|
||||||
|
# gnome-settings-daemon XKEYBOARD:SetControls
|
||||||
|
allow $2 $1_xserver_t:x_server manage;
|
||||||
|
|
||||||
|
# gnome-settings-daemon RANDR:SelectInput
|
||||||
|
allow $2 $1_xserver_t:x_resource write;
|
||||||
|
|
||||||
|
# metacity X11:InstallColormap X11:UninstallColormap
|
||||||
|
allow $2 $1_rootwindow_t:x_colormap { install uninstall };
|
||||||
|
|
||||||
|
# read: gnome-settings-daemon RANDR:GetScreenSizeRange
|
||||||
|
# write: gnome-settings-daemon RANDR:SelectInput
|
||||||
|
# setattr: gnome-settings-daemon X11:GrabKey
|
||||||
|
# manage: metacity X11:ChangeWindowAttributes
|
||||||
|
allow $2 $1_rootwindow_t:x_drawable { read write manage setattr };
|
||||||
|
|
||||||
|
# setattr: metacity X11:InstallColormap
|
||||||
|
allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr };
|
||||||
|
|
||||||
|
# xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
|
||||||
|
allow $2 info_xproperty_t:x_property { create write append };
|
||||||
|
|
||||||
|
mls_xwin_read_to_clearance($1_xserver_t)
|
||||||
|
|
||||||
|
xserver_common_x_domain_template($1,$1,$2)
|
||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
@ -521,7 +607,7 @@ template(`xserver_rw_session_template',`
|
|||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
template(`xserver_user_client_template',`
|
template(`xserver_user_client_template',`
|
||||||
|
# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type xdm_t, xdm_tmp_t;
|
type xdm_t, xdm_tmp_t;
|
||||||
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
|
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
|
||||||
@ -564,6 +650,279 @@ template(`xserver_user_client_template',`
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
## <summary>
|
||||||
|
## Interface to provide X object permissions on a given X server to
|
||||||
|
## an X client domain. Provides the minimal set required by a basic
|
||||||
|
## X client application.
|
||||||
|
## </summary>
|
||||||
|
## <param name="user">
|
||||||
|
## <summary>
|
||||||
|
## The prefix of the X server domain (e.g., user
|
||||||
|
## is the prefix for user_t).
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="prefix">
|
||||||
|
## <summary>
|
||||||
|
## The prefix of the X client domain (e.g., user
|
||||||
|
## is the prefix for user_t).
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Client domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
template(`xserver_common_x_domain_template',`
|
||||||
|
gen_require(`
|
||||||
|
type $1_rootwindow_t, std_xext_t, shmem_xext_t;
|
||||||
|
type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
|
||||||
|
type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
|
||||||
|
type xevent_t, client_xevent_t;
|
||||||
|
type clipboard_xselection_t, xselection_t;
|
||||||
|
|
||||||
|
attribute x_server_domain, x_domain;
|
||||||
|
attribute xproperty_type;
|
||||||
|
attribute xevent_type, xextension_type;
|
||||||
|
attribute $1_x_domain, $1_input_xevent_type;
|
||||||
|
|
||||||
|
class x_drawable all_x_drawable_perms;
|
||||||
|
class x_screen all_x_screen_perms;
|
||||||
|
class x_gc all_x_gc_perms;
|
||||||
|
class x_font all_x_font_perms;
|
||||||
|
class x_colormap all_x_colormap_perms;
|
||||||
|
class x_property all_x_property_perms;
|
||||||
|
class x_selection all_x_selection_perms;
|
||||||
|
class x_cursor all_x_cursor_perms;
|
||||||
|
class x_client all_x_client_perms;
|
||||||
|
class x_device all_x_device_perms;
|
||||||
|
class x_server all_x_server_perms;
|
||||||
|
class x_extension all_x_extension_perms;
|
||||||
|
class x_resource all_x_resource_perms;
|
||||||
|
class x_event all_x_event_perms;
|
||||||
|
class x_synthetic_event all_x_synthetic_event_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
##############################
|
||||||
|
#
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
# Type attributes
|
||||||
|
typeattribute $3 $1_x_domain, x_domain;
|
||||||
|
|
||||||
|
# Types for properties
|
||||||
|
type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type;
|
||||||
|
|
||||||
|
# Types for events
|
||||||
|
type $2_input_xevent_t, $1_input_xevent_type, xevent_type;
|
||||||
|
type $2_property_xevent_t, xevent_type;
|
||||||
|
type $2_focus_xevent_t, xevent_type;
|
||||||
|
type $2_manage_xevent_t, xevent_type;
|
||||||
|
type $2_default_xevent_t, xevent_type;
|
||||||
|
type $2_client_xevent_t, xevent_type;
|
||||||
|
|
||||||
|
##############################
|
||||||
|
#
|
||||||
|
# Local Policy
|
||||||
|
#
|
||||||
|
|
||||||
|
# Hacks
|
||||||
|
# everyone can get the input focus of everyone else
|
||||||
|
# this is a fundamental brokenness in the X protocol
|
||||||
|
allow $3 { x_domain x_server_domain }:x_device getfocus;
|
||||||
|
# everyone can grab the server
|
||||||
|
# everyone does it, it is basically a free DOS attack
|
||||||
|
allow $3 x_server_domain:x_server grab;
|
||||||
|
# everyone can get the font path, etc.
|
||||||
|
# this could leak out sensitive information
|
||||||
|
allow $3 x_server_domain:x_server getattr;
|
||||||
|
# everyone can do override-redirect windows.
|
||||||
|
# this could be used to spoof labels
|
||||||
|
allow $3 self:x_drawable override;
|
||||||
|
# everyone can receive management events on the root window
|
||||||
|
# allows to know when new windows appear, among other things
|
||||||
|
allow $3 manage_xevent_t:x_event receive;
|
||||||
|
|
||||||
|
# X Server
|
||||||
|
# can read server-owned resources
|
||||||
|
allow $3 x_server_domain:x_resource read;
|
||||||
|
# can mess with own clients
|
||||||
|
allow $3 self:x_client { manage destroy };
|
||||||
|
|
||||||
|
# X Protocol Extensions
|
||||||
|
allow $3 std_xext_t:x_extension { query use };
|
||||||
|
allow $3 shmem_xext_t:x_extension { query use };
|
||||||
|
dontaudit $3 xextension_type:x_extension { query use };
|
||||||
|
|
||||||
|
# X Properties
|
||||||
|
# can read and write client properties
|
||||||
|
allow $3 $2_xproperty_t:x_property { create destroy read write append };
|
||||||
|
type_transition $3 xproperty_t:x_property $2_xproperty_t;
|
||||||
|
# can read and write cut buffers
|
||||||
|
allow $3 clipboard_xproperty_t:x_property { create read write append };
|
||||||
|
# can read info properties
|
||||||
|
allow $3 info_xproperty_t:x_property read;
|
||||||
|
# can change properties of root window
|
||||||
|
allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property };
|
||||||
|
# can change properties of own windows
|
||||||
|
allow $3 self:x_drawable { list_property get_property set_property };
|
||||||
|
|
||||||
|
# X Windows
|
||||||
|
# operations allowed on root windows
|
||||||
|
allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive };
|
||||||
|
# operations allowed on my windows
|
||||||
|
allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
|
||||||
|
type_transition $3 $1_rootwindow_t:x_drawable $3;
|
||||||
|
|
||||||
|
# X Colormaps
|
||||||
|
# can use the default colormap
|
||||||
|
allow $3 $1_rootwindow_t:x_colormap { read use add_color };
|
||||||
|
|
||||||
|
# X Input
|
||||||
|
# can receive own events
|
||||||
|
allow $3 $2_input_xevent_t:{ x_event x_synthetic_event } receive;
|
||||||
|
allow $3 $2_property_xevent_t:{ x_event x_synthetic_event } receive;
|
||||||
|
allow $3 $2_focus_xevent_t:{ x_event x_synthetic_event } receive;
|
||||||
|
allow $3 $2_manage_xevent_t:{ x_event x_synthetic_event } receive;
|
||||||
|
allow $3 $2_default_xevent_t:{ x_event x_synthetic_event } receive;
|
||||||
|
allow $3 $2_client_xevent_t:{ x_event x_synthetic_event } receive;
|
||||||
|
type_transition $3 input_xevent_t:x_event $2_input_xevent_t;
|
||||||
|
type_transition $3 property_xevent_t:x_event $2_property_xevent_t;
|
||||||
|
type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t;
|
||||||
|
type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t;
|
||||||
|
type_transition $3 client_xevent_t:x_event $2_client_xevent_t;
|
||||||
|
type_transition $3 xevent_t:x_event $2_default_xevent_t;
|
||||||
|
# can receive certain root window events
|
||||||
|
allow $3 focus_xevent_t:x_event receive;
|
||||||
|
allow $3 property_xevent_t:x_event receive;
|
||||||
|
allow $3 client_xevent_t:x_synthetic_event receive;
|
||||||
|
allow $3 manage_xevent_t:x_synthetic_event receive;
|
||||||
|
# can send ICCCM events to myself
|
||||||
|
allow $3 $2_manage_xevent_t:x_synthetic_event send;
|
||||||
|
# can send ICCCM events to the root window
|
||||||
|
allow $3 manage_xevent_t:x_synthetic_event send;
|
||||||
|
allow $3 client_xevent_t:x_synthetic_event send;
|
||||||
|
|
||||||
|
# X Selections
|
||||||
|
# can use the clipboard
|
||||||
|
allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
|
||||||
|
# can query all other selections
|
||||||
|
allow $3 xselection_t:x_selection { getattr read };
|
||||||
|
|
||||||
|
# Other X Objects
|
||||||
|
# can create and use cursors
|
||||||
|
allow $3 self:x_cursor *;
|
||||||
|
# can create and use graphics contexts
|
||||||
|
allow $3 self:x_gc *;
|
||||||
|
# can create and use colormaps
|
||||||
|
allow $3 self:x_colormap *;
|
||||||
|
# can read and write own objects
|
||||||
|
allow $3 self:x_resource { read write };
|
||||||
|
|
||||||
|
tunable_policy(`! xserver_object_manager',`
|
||||||
|
# should be xserver_unconfined($3),
|
||||||
|
# but typeattribute doesnt work in conditionals
|
||||||
|
gen_require(`
|
||||||
|
attribute x_server_domain, x_domain;
|
||||||
|
attribute xproperty_type, xselection_type;
|
||||||
|
attribute xextension_type, xevent_type;
|
||||||
|
attribute rootwindow_type;
|
||||||
|
|
||||||
|
type remote_xclient_t;
|
||||||
|
')
|
||||||
|
allow $3 x_server_domain:x_server *;
|
||||||
|
allow $3 { x_domain rootwindow_type }:x_drawable *;
|
||||||
|
allow $3 x_server_domain:x_screen *;
|
||||||
|
allow $3 x_domain:x_gc *;
|
||||||
|
allow $3 { x_domain rootwindow_type }:x_colormap *;
|
||||||
|
allow $3 xproperty_type:x_property *;
|
||||||
|
allow $3 xselection_type:x_selection *;
|
||||||
|
allow $3 x_domain:x_cursor *;
|
||||||
|
allow $3 { x_domain remote_xclient_t }:x_client *;
|
||||||
|
allow $3 { x_domain x_server_domain }:x_device *;
|
||||||
|
allow $3 xextension_type:x_extension *;
|
||||||
|
allow $3 { x_domain x_server_domain }:x_resource *;
|
||||||
|
allow $3 xevent_type:{ x_event x_synthetic_event } *;
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
## <summary>
|
||||||
|
## Interface to provide X object permissions on a given X server to
|
||||||
|
## an X client domain. Provides the minimal set required by a basic
|
||||||
|
## X client application.
|
||||||
|
## </summary>
|
||||||
|
## <param name="user">
|
||||||
|
## <summary>
|
||||||
|
## The prefix of the X server domain (e.g., user
|
||||||
|
## is the prefix for user_t).
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="prefix">
|
||||||
|
## <summary>
|
||||||
|
## The prefix of the X client domain (e.g., user
|
||||||
|
## is the prefix for user_t).
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Client domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="tmpfs_type">
|
||||||
|
## <summary>
|
||||||
|
## The type of the domain SYSV tmpfs files.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
template(`xserver_user_x_domain_template',`
|
||||||
|
gen_require(`
|
||||||
|
type xdm_t, xdm_tmp_t;
|
||||||
|
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $3 self:shm create_shm_perms;
|
||||||
|
allow $3 self:unix_dgram_socket create_socket_perms;
|
||||||
|
allow $3 self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||||
|
|
||||||
|
# Read .Xauthority file
|
||||||
|
allow $3 $1_xauth_home_t:file { getattr read };
|
||||||
|
allow $3 $1_iceauth_home_t:file { getattr read };
|
||||||
|
|
||||||
|
# for when /tmp/.X11-unix is created by the system
|
||||||
|
allow $3 xdm_t:fd use;
|
||||||
|
allow $3 xdm_t:fifo_file { getattr read write ioctl };
|
||||||
|
allow $3 xdm_tmp_t:dir search;
|
||||||
|
allow $3 xdm_tmp_t:sock_file { read write };
|
||||||
|
dontaudit $3 xdm_t:tcp_socket { read write };
|
||||||
|
|
||||||
|
# Allow connections to X server.
|
||||||
|
files_search_tmp($3)
|
||||||
|
|
||||||
|
miscfiles_read_fonts($3)
|
||||||
|
|
||||||
|
userdom_search_user_home_dirs($1,$3)
|
||||||
|
# for .xsession-errors
|
||||||
|
userdom_dontaudit_write_user_home_content_files($1,$3)
|
||||||
|
|
||||||
|
xserver_ro_session_template(xdm,$3,$4)
|
||||||
|
xserver_rw_session_template($1,$3,$4)
|
||||||
|
xserver_use_user_fonts($1,$3)
|
||||||
|
|
||||||
|
xserver_read_xdm_tmp_files($3)
|
||||||
|
|
||||||
|
# X object manager
|
||||||
|
xserver_common_x_domain_template($1,$2,$3)
|
||||||
|
|
||||||
|
# Client write xserver shm
|
||||||
|
tunable_policy(`allow_write_xshm',`
|
||||||
|
allow $3 $1_xserver_t:shm rw_shm_perms;
|
||||||
|
allow $3 $1_xserver_tmpfs_t:file rw_file_perms;
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Read user fonts, user font configuration,
|
## Read user fonts, user font configuration,
|
||||||
@ -1312,3 +1671,23 @@ interface(`xserver_stream_connect_xdm_xserver',`
|
|||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
|
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Interface to provide X object permissions on a given X server to
|
||||||
|
## an X client domain. Gives the domain complete control over the
|
||||||
|
## display.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`xserver_unconfined',`
|
||||||
|
gen_require(`
|
||||||
|
attribute xserver_unconfined_type;
|
||||||
|
')
|
||||||
|
|
||||||
|
typeattribute $1 xserver_unconfined_type;
|
||||||
|
')
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(xserver,1.7.0)
|
policy_module(xserver,2.0.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -21,14 +21,58 @@ gen_tunable(allow_write_xshm,false)
|
|||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(xdm_sysadm_login,false)
|
gen_tunable(xdm_sysadm_login,false)
|
||||||
|
|
||||||
|
## <desc>
|
||||||
|
## <p>
|
||||||
|
## Support X userspace object manager
|
||||||
|
## </p>
|
||||||
|
## </desc>
|
||||||
|
gen_tunable(xserver_object_manager,false)
|
||||||
|
|
||||||
attribute fonts_type;
|
attribute fonts_type;
|
||||||
attribute fonts_cache_type;
|
attribute fonts_cache_type;
|
||||||
attribute fonts_config_type;
|
attribute fonts_config_type;
|
||||||
attribute xauth_home_type;
|
attribute xauth_home_type;
|
||||||
|
|
||||||
|
# Domains
|
||||||
|
attribute xserver_unconfined_type;
|
||||||
|
attribute x_server_domain;
|
||||||
|
|
||||||
|
# Per-object attributes
|
||||||
|
attribute rootwindow_type;
|
||||||
|
attribute x_domain;
|
||||||
|
attribute xproperty_type;
|
||||||
|
attribute xselection_type;
|
||||||
|
attribute xextension_type;
|
||||||
|
attribute xevent_type;
|
||||||
|
|
||||||
|
type accelgraphics_xext_t, xextension_type;
|
||||||
|
type client_xevent_t, xevent_type;
|
||||||
|
type clipboard_xproperty_t, xproperty_type;
|
||||||
|
type clipboard_xselection_t, xselection_type;
|
||||||
|
type debug_xext_t, xextension_type;
|
||||||
|
type directhw_xext_t alias disallowed_xext_t, xextension_type;
|
||||||
|
type focus_xevent_t, xevent_type;
|
||||||
|
|
||||||
type iceauth_exec_t;
|
type iceauth_exec_t;
|
||||||
application_executable_file(iceauth_exec_t)
|
application_executable_file(iceauth_exec_t)
|
||||||
|
|
||||||
|
type info_xproperty_t, xproperty_type;
|
||||||
|
type input_xevent_t, xevent_type;
|
||||||
|
type manage_xevent_t, xevent_type;
|
||||||
|
type output_xext_t, xextension_type;
|
||||||
|
type property_xevent_t, xevent_type;
|
||||||
|
type remote_xclient_t;
|
||||||
|
type screensaver_xext_t, xextension_type;
|
||||||
|
type security_xext_t, xextension_type;
|
||||||
|
type shmem_xext_t, xextension_type;
|
||||||
|
type std_xext_t, xextension_type;
|
||||||
|
type video_xext_t, xextension_type;
|
||||||
|
type unknown_xevent_t, xevent_type;
|
||||||
|
type xevent_t alias default_xevent_t, xevent_type;
|
||||||
|
type xext_t alias unknown_xext_t, xextension_type;
|
||||||
|
type xproperty_t alias default_xproperty_t, xproperty_type;
|
||||||
|
type xselection_t alias default_xselection_t, xselection_type;
|
||||||
|
|
||||||
type xauth_exec_t;
|
type xauth_exec_t;
|
||||||
application_executable_file(xauth_exec_t)
|
application_executable_file(xauth_exec_t)
|
||||||
|
|
||||||
@ -79,6 +123,7 @@ type xserver_log_t;
|
|||||||
logging_log_file(xserver_log_t)
|
logging_log_file(xserver_log_t)
|
||||||
|
|
||||||
xserver_common_domain_template(xdm)
|
xserver_common_domain_template(xdm)
|
||||||
|
xserver_common_x_domain_template(xdm,xdm,xdm_t)
|
||||||
init_system_domain(xdm_xserver_t,xserver_exec_t)
|
init_system_domain(xdm_xserver_t,xserver_exec_t)
|
||||||
|
|
||||||
ifdef(`enable_mcs',`
|
ifdef(`enable_mcs',`
|
||||||
@ -272,6 +317,7 @@ userdom_read_all_users_state(xdm_t)
|
|||||||
userdom_signal_all_users(xdm_t)
|
userdom_signal_all_users(xdm_t)
|
||||||
|
|
||||||
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
|
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
|
||||||
|
xserver_unconfined(xdm_t)
|
||||||
|
|
||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
fs_manage_nfs_dirs(xdm_t)
|
fs_manage_nfs_dirs(xdm_t)
|
||||||
@ -441,6 +487,25 @@ optional_policy(`
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Rules for unconfined access to this module
|
||||||
|
#
|
||||||
|
|
||||||
|
allow xserver_unconfined_type x_server_domain:x_server *;
|
||||||
|
allow xserver_unconfined_type { x_domain rootwindow_type }:x_drawable *;
|
||||||
|
allow xserver_unconfined_type x_server_domain:x_screen *;
|
||||||
|
allow xserver_unconfined_type x_domain:x_gc *;
|
||||||
|
allow xserver_unconfined_type { x_domain rootwindow_type }:x_colormap *;
|
||||||
|
allow xserver_unconfined_type xproperty_type:x_property *;
|
||||||
|
allow xserver_unconfined_type xselection_type:x_selection *;
|
||||||
|
allow xserver_unconfined_type x_domain:x_cursor *;
|
||||||
|
allow xserver_unconfined_type { x_domain remote_xclient_t }:x_client *;
|
||||||
|
allow xserver_unconfined_type { x_domain x_server_domain }:x_device *;
|
||||||
|
allow xserver_unconfined_type xextension_type:x_extension *;
|
||||||
|
allow xserver_unconfined_type { x_domain x_server_domain }:x_resource *;
|
||||||
|
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
|
||||||
|
|
||||||
ifdef(`TODO',`
|
ifdef(`TODO',`
|
||||||
# Need to further investigate these permissions and
|
# Need to further investigate these permissions and
|
||||||
# perhaps define derived types.
|
# perhaps define derived types.
|
||||||
|
|||||||
@ -95,6 +95,10 @@ interface(`unconfined_domain_noaudit',`
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
storage_unconfined($1)
|
storage_unconfined($1)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
xserver_unconfined($1)
|
||||||
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(unconfined,2.1.0)
|
policy_module(unconfined,2.1.1)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
|
|||||||
@ -74,6 +74,7 @@ make NAME=%{polname2} TYPE=%{type2} DISTRO=%{distro} DIRECT_INITRC=%{direct_init
|
|||||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/initrc_context
|
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/initrc_context
|
||||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/removable_context
|
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/removable_context
|
||||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/userhelper_context
|
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/userhelper_context
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/x_contexts
|
||||||
%dir %{_sysconfdir}/selinux/*/contexts/files
|
%dir %{_sysconfdir}/selinux/*/contexts/files
|
||||||
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/file_contexts
|
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/file_contexts
|
||||||
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/homedir_template
|
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/homedir_template
|
||||||
@ -117,6 +118,7 @@ SELinux Reference policy targeted base module.
|
|||||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/initrc_context
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/initrc_context
|
||||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/removable_context
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/removable_context
|
||||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/userhelper_context
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/userhelper_context
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/x_contexts
|
||||||
%dir %{_sysconfdir}/selinux/%{polname1}/contexts/files
|
%dir %{_sysconfdir}/selinux/%{polname1}/contexts/files
|
||||||
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/file_contexts
|
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/file_contexts
|
||||||
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/homedir_template
|
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/homedir_template
|
||||||
@ -162,6 +164,7 @@ SELinux Reference policy strict base module.
|
|||||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/initrc_context
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/initrc_context
|
||||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/removable_context
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/removable_context
|
||||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/userhelper_context
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/userhelper_context
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/x_contexts
|
||||||
%dir %{_sysconfdir}/selinux/%{polname2}/contexts/files
|
%dir %{_sysconfdir}/selinux/%{polname2}/contexts/files
|
||||||
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/file_contexts
|
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/file_contexts
|
||||||
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/homedir_template
|
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/homedir_template
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user